jif 164b3bfeab Isolate MCP OAuth credentials by environment (#36310) ...

## Why

MCP servers running in an executor must not reuse host-owned OAuth credentials,
even when they have the same configured server name and URL.

## What changed

- Derive environment-scoped credential names for executor-owned MCP servers and
  use them consistently for login, logout, authentication, and connection setup.
- Mark executor-owned entries in the file credential store and fail closed when
  loading or saving an entry could cross the host/executor boundary.
- Preserve compatibility with existing local OAuth credentials, including local
  server names that overlap the new reserved prefixes.

## Testing

- Extend the executor MCP integration test to verify that executor requests use
  the executor token, never send the host token, and persist both credentials
  separately.

GitOrigin-RevId: 4fc92d0533b0fe2e0df34f6d47b81e3d20d07807

2026-07-31 11:23:46 +00:00

..

common

Track parent turns for nested Codex requests (#35835)

2026-07-28 21:58:33 +00:00

remote_env_windows

Scope runtime workspace roots to execution environments (#32952)

2026-07-14 04:41:08 +00:00

suite

Isolate MCP OAuth credentials by environment (#36310)

2026-07-31 11:23:46 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Allow custom providers to opt into standalone web search (#34846)

2026-07-23 00:02:15 +00:00